Skip to content

Commit ffe802b

Browse files
megvanhuygenmegvanhuygen
authored
Merge pull request #107490 from rolyon/rolyon-rbac-roles-march
[Azure RBAC] Updates to roles and operations for March
2 parents d950a68 + fb16385 commit ffe802b

File tree

2 files changed

+307
-103
lines changed

2 files changed

+307
-103
lines changed

‎articles/role-based-access-control/built-in-roles.md

Lines changed: 38 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ ms.devlang:
1212
ms.topic: reference
1313
ms.tgt_pltfrm:
1414
ms.workload: identity
15-
ms.date: 02/18/2020
15+
ms.date: 03/12/2020
1616
ms.author: rolyon
1717
ms.reviewer: bagovind
1818

@@ -73,14 +73,14 @@ The following table provides a brief description and the unique ID of each built
7373
> | [Blockchain Member Node Access (Preview)](#blockchain-member-node-access-preview) | Allows for access to Blockchain Member nodes | 31a002a1-acaf-453e-8a5b-297c9ca1ea24 |
7474
> | [Blueprint Contributor](#blueprint-contributor) | Can manage blueprint definitions, but not assign them. | 41077137-e803-4205-871c-5a86e6a753b4 |
7575
> | [Blueprint Operator](#blueprint-operator) | Can assign existing published blueprints, but cannot create new blueprints. NOTE: this only works if the assignment is done with a user-assigned managed identity. | 437d2ced-4a38-4302-8479-ed2bcb43d090 |
76-
> | [CDN Endpoint Contributor](#cdn-endpoint-contributor) | Can manage CDN endpoints, but can’t grant access to other users. | 426e0c7f-0c7e-4658-b36f-ff54d6c29b45 |
77-
> | [CDN Endpoint Reader](#cdn-endpoint-reader) | Can view CDN endpoints, but can’t make changes. | 871e35f6-b5c1-49cc-a043-bde969a0f2cd |
78-
> | [CDN Profile Contributor](#cdn-profile-contributor) | Can manage CDN profiles and their endpoints, but can’t grant access to other users. | ec156ff8-a8d1-4d15-830c-5b80698ca432 |
79-
> | [CDN Profile Reader](#cdn-profile-reader) | Can view CDN profiles and their endpoints, but can’t make changes. | 8f96442b-4075-438f-813d-ad51ab4019af |
76+
> | [CDN Endpoint Contributor](#cdn-endpoint-contributor) | Can manage CDN endpoints, but can't grant access to other users. | 426e0c7f-0c7e-4658-b36f-ff54d6c29b45 |
77+
> | [CDN Endpoint Reader](#cdn-endpoint-reader) | Can view CDN endpoints, but can't make changes. | 871e35f6-b5c1-49cc-a043-bde969a0f2cd |
78+
> | [CDN Profile Contributor](#cdn-profile-contributor) | Can manage CDN profiles and their endpoints, but can't grant access to other users. | ec156ff8-a8d1-4d15-830c-5b80698ca432 |
79+
> | [CDN Profile Reader](#cdn-profile-reader) | Can view CDN profiles and their endpoints, but can't make changes. | 8f96442b-4075-438f-813d-ad51ab4019af |
8080
> | [Classic Network Contributor](#classic-network-contributor) | Lets you manage classic networks, but not access to them. | b34d265f-36f7-4a0d-a4d4-e158ca92e90f |
8181
> | [Classic Storage Account Contributor](#classic-storage-account-contributor) | Lets you manage classic storage accounts, but not access to them. | 86e8f5dc-a6e9-4c67-9d15-de283e8eac25 |
8282
> | [Classic Storage Account Key Operator Service Role](#classic-storage-account-key-operator-service-role) | Classic Storage Account Key Operators are allowed to list and regenerate keys on Classic Storage Accounts | 985d6b00-f706-48f5-a6fe-d0ca12fb668d |
83-
> | [Classic Virtual Machine Contributor](#classic-virtual-machine-contributor) | Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they’re connected to. | d73bb868-a0df-4d4d-bd69-98a00b01fccb |
83+
> | [Classic Virtual Machine Contributor](#classic-virtual-machine-contributor) | Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they're connected to. | d73bb868-a0df-4d4d-bd69-98a00b01fccb |
8484
> | [Cognitive Services Contributor](#cognitive-services-contributor) | Lets you create, read, update, delete and manage keys of Cognitive Services. | 25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68 |
8585
> | [Cognitive Services Data Reader (Preview)](#cognitive-services-data-reader-preview) | Lets you read Cognitive Services data. | b59867f0-fa02-499b-be73-45a86b5b3e1c |
8686
> | [Cognitive Services User](#cognitive-services-user) | Lets you read and list keys of Cognitive Services. | a97b65f3-24c7-4388-baec-2e87135dc908 |
@@ -141,7 +141,7 @@ The following table provides a brief description and the unique ID of each built
141141
> | [Spatial Anchors Account Owner](#spatial-anchors-account-owner) | Lets you manage spatial anchors in your account, including deleting them | 70bbe301-9835-447d-afdd-19eb3167307c |
142142
> | [Spatial Anchors Account Reader](#spatial-anchors-account-reader) | Lets you locate and read properties of spatial anchors in your account | 5d51204f-eb77-4b1c-b86a-2ec626c49413 |
143143
> | [SQL DB Contributor](#sql-db-contributor) | Lets you manage SQL databases, but not access to them. Also, you can't manage their security-related policies or their parent SQL servers. | 9b7fa17d-e63e-47b0-bb0a-15c516ac86ec |
144-
> | [SQL Managed Instance Contributor](#sql-managed-instance-contributor) | Lets you manage SQL Managed Instances and required network configuration, but can’t give access to others. | 4939a1f6-9ae0-4e48-a1e0-f2cbe897382d |
144+
> | [SQL Managed Instance Contributor](#sql-managed-instance-contributor) | Lets you manage SQL Managed Instances and required network configuration, but can't give access to others. | 4939a1f6-9ae0-4e48-a1e0-f2cbe897382d |
145145
> | [SQL Security Manager](#sql-security-manager) | Lets you manage the security-related policies of SQL servers and databases, but not access to them. | 056cd41c-7e88-42e1-933e-88ba6a50c9c3 |
146146
> | [SQL Server Contributor](#sql-server-contributor) | Lets you manage SQL servers and databases, but not access to them, and not their security -related policies. | 6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437 |
147147
> | [Storage Account Contributor](#storage-account-contributor) | Permits management of storage accounts. Provides access to the account key, which can be used to access data via Shared Key authorization. | 17d1049b-9a84-46fb-8f53-869881c3d3ab |
@@ -1020,7 +1020,7 @@ Allows for access to Blockchain Member nodes
10201020

10211021
### Classic Virtual Machine Contributor
10221022

1023-
Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they’re connected to.
1023+
Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they're connected to.
10241024

10251025
> [!div class="mx-tableFixed"]
10261026
> | | |
@@ -1055,7 +1055,7 @@ Lets you manage classic virtual machines, but not access to them, and not the vi
10551055
"assignableScopes": [
10561056
"/"
10571057
],
1058-
"description": "Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they’re connected to.",
1058+
"description": "Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they're connected to.",
10591059
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/d73bb868-a0df-4d4d-bd69-98a00b01fccb",
10601060
"name": "d73bb868-a0df-4d4d-bd69-98a00b01fccb",
10611061
"permissions": [
@@ -2016,7 +2016,7 @@ Lets you manage SQL databases, but not access to them. Also, you can't manage th
20162016

20172017
### SQL Managed Instance Contributor
20182018

2019-
Lets you manage SQL Managed Instances and required network configuration, but can’t give access to others.
2019+
Lets you manage SQL Managed Instances and required network configuration, but can't give access to others.
20202020

20212021
> [!div class="mx-tableFixed"]
20222022
> | | |
@@ -2048,7 +2048,7 @@ Lets you manage SQL Managed Instances and required network configuration, but ca
20482048
"assignableScopes": [
20492049
"/"
20502050
],
2051-
"description": "Lets you manage SQL Managed Instances and required network configuration, but can’t give access to others.",
2051+
"description": "Lets you manage SQL Managed Instances and required network configuration, but can't give access to others.",
20522052
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/4939a1f6-9ae0-4e48-a1e0-f2cbe897382d",
20532053
"name": "4939a1f6-9ae0-4e48-a1e0-f2cbe897382d",
20542054
"permissions": [
@@ -3849,10 +3849,7 @@ Can manage blueprint definitions, but not assign them.
38493849

38503850
### Blueprint Operator
38513851

3852-
Can assign existing published blueprints, but cannot create new blueprints.
3853-
3854-
> [!NOTE]
3855-
> This works only if the assignment is done with a user-assigned managed identity.
3852+
Can assign existing published blueprints, but cannot create new blueprints. NOTE: this only works if the assignment is done with a user-assigned managed identity.
38563853

38573854
> [!div class="mx-tableFixed"]
38583855
> | | |
@@ -4312,6 +4309,8 @@ Can read all monitoring data and edit monitoring settings. See also [Get started
43124309
> | Microsoft.WorkloadMonitor/monitors/* | |
43134310
> | Microsoft.WorkloadMonitor/notificationSettings/* | |
43144311
> | Microsoft.AlertsManagement/smartDetectorAlertRules/* | |
4312+
> | Microsoft.AlertsManagement/actionRules/* | |
4313+
> | Microsoft.AlertsManagement/smartGroups/* | |
43154314
> | **NotActions** | |
43164315
> | *none* | |
43174316
> | **DataActions** | |
@@ -4355,7 +4354,9 @@ Can read all monitoring data and edit monitoring settings. See also [Get started
43554354
"Microsoft.Support/*",
43564355
"Microsoft.WorkloadMonitor/monitors/*",
43574356
"Microsoft.WorkloadMonitor/notificationSettings/*",
4358-
"Microsoft.AlertsManagement/smartDetectorAlertRules/*"
4357+
"Microsoft.AlertsManagement/smartDetectorAlertRules/*",
4358+
"Microsoft.AlertsManagement/actionRules/*",
4359+
"Microsoft.AlertsManagement/smartGroups/*"
43594360
],
43604361
"notActions": [],
43614362
"dataActions": [],
@@ -5292,7 +5293,7 @@ Lets you locate and read properties of spatial anchors in your account
52925293

52935294
### CDN Endpoint Contributor
52945295

5295-
Can manage CDN endpoints, but can’t grant access to other users.
5296+
Can manage CDN endpoints, but can't grant access to other users.
52965297

52975298
> [!div class="mx-tableFixed"]
52985299
> | | |
@@ -5318,7 +5319,7 @@ Can manage CDN endpoints, but can’t grant access to other users.
53185319
"assignableScopes": [
53195320
"/"
53205321
],
5321-
"description": "Can manage CDN endpoints, but can’t grant access to other users.",
5322+
"description": "Can manage CDN endpoints, but can't grant access to other users.",
53225323
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/426e0c7f-0c7e-4658-b36f-ff54d6c29b45",
53235324
"name": "426e0c7f-0c7e-4658-b36f-ff54d6c29b45",
53245325
"permissions": [
@@ -5346,7 +5347,7 @@ Can manage CDN endpoints, but can’t grant access to other users.
53465347

53475348
### CDN Endpoint Reader
53485349

5349-
Can view CDN endpoints, but can’t make changes.
5350+
Can view CDN endpoints, but can't make changes.
53505351

53515352
> [!div class="mx-tableFixed"]
53525353
> | | |
@@ -5372,7 +5373,7 @@ Can view CDN endpoints, but can’t make changes.
53725373
"assignableScopes": [
53735374
"/"
53745375
],
5375-
"description": "Can view CDN endpoints, but can’t make changes.",
5376+
"description": "Can view CDN endpoints, but can't make changes.",
53765377
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/871e35f6-b5c1-49cc-a043-bde969a0f2cd",
53775378
"name": "871e35f6-b5c1-49cc-a043-bde969a0f2cd",
53785379
"permissions": [
@@ -5400,7 +5401,7 @@ Can view CDN endpoints, but can’t make changes.
54005401

54015402
### CDN Profile Contributor
54025403

5403-
Can manage CDN profiles and their endpoints, but can’t grant access to other users.
5404+
Can manage CDN profiles and their endpoints, but can't grant access to other users.
54045405

54055406
> [!div class="mx-tableFixed"]
54065407
> | | |
@@ -5426,7 +5427,7 @@ Can manage CDN profiles and their endpoints, but can’t grant access to other u
54265427
"assignableScopes": [
54275428
"/"
54285429
],
5429-
"description": "Can manage CDN profiles and their endpoints, but can’t grant access to other users.",
5430+
"description": "Can manage CDN profiles and their endpoints, but can't grant access to other users.",
54305431
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/ec156ff8-a8d1-4d15-830c-5b80698ca432",
54315432
"name": "ec156ff8-a8d1-4d15-830c-5b80698ca432",
54325433
"permissions": [
@@ -5454,7 +5455,7 @@ Can manage CDN profiles and their endpoints, but can’t grant access to other u
54545455

54555456
### CDN Profile Reader
54565457

5457-
Can view CDN profiles and their endpoints, but can’t make changes.
5458+
Can view CDN profiles and their endpoints, but can't make changes.
54585459

54595460
> [!div class="mx-tableFixed"]
54605461
> | | |
@@ -5480,7 +5481,7 @@ Can view CDN profiles and their endpoints, but can’t make changes.
54805481
"assignableScopes": [
54815482
"/"
54825483
],
5483-
"description": "Can view CDN profiles and their endpoints, but can’t make changes.",
5484+
"description": "Can view CDN profiles and their endpoints, but can't make changes.",
54845485
"id": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/8f96442b-4075-438f-813d-ad51ab4019af",
54855486
"name": "8f96442b-4075-438f-813d-ad51ab4019af",
54865487
"permissions": [
@@ -5727,7 +5728,7 @@ Azure Sentinel Contributor
57275728
> | **Actions** | |
57285729
> | Microsoft.SecurityInsights/* | |
57295730
> | Microsoft.OperationalInsights/workspaces/analytics/query/action | Search using new engine. |
5730-
> | Microsoft.OperationalInsights/workspaces/read | Gets an existing workspace |
5731+
> | Microsoft.OperationalInsights/workspaces/*/read | View log analytics data |
57315732
> | Microsoft.OperationalInsights/workspaces/savedSearches/* | |
57325733
> | Microsoft.OperationsManagement/solutions/read | Get exiting OMS solution |
57335734
> | Microsoft.OperationalInsights/workspaces/query/read | Run queries over the data in the workspace |
@@ -5759,7 +5760,7 @@ Azure Sentinel Contributor
57595760
"actions": [
57605761
"Microsoft.SecurityInsights/*",
57615762
"Microsoft.OperationalInsights/workspaces/analytics/query/action",
5762-
"Microsoft.OperationalInsights/workspaces/read",
5763+
"Microsoft.OperationalInsights/workspaces/*/read",
57635764
"Microsoft.OperationalInsights/workspaces/savedSearches/*",
57645765
"Microsoft.OperationsManagement/solutions/read",
57655766
"Microsoft.OperationalInsights/workspaces/query/read",
@@ -5793,7 +5794,8 @@ Azure Sentinel Reader
57935794
> | **Actions** | |
57945795
> | Microsoft.SecurityInsights/*/read | |
57955796
> | Microsoft.OperationalInsights/workspaces/analytics/query/action | Search using new engine. |
5796-
> | Microsoft.OperationalInsights/workspaces/read | Gets an existing workspace |
5797+
> | Microsoft.OperationalInsights/workspaces/*/read | View log analytics data |
5798+
> | Microsoft.OperationalInsights/workspaces/LinkedServices/read | Get linked services under given workspace. |
57975799
> | Microsoft.OperationalInsights/workspaces/savedSearches/read | Gets a saved search query |
57985800
> | Microsoft.OperationsManagement/solutions/read | Get exiting OMS solution |
57995801
> | Microsoft.OperationalInsights/workspaces/query/read | Run queries over the data in the workspace |
@@ -5825,7 +5827,8 @@ Azure Sentinel Reader
58255827
"actions": [
58265828
"Microsoft.SecurityInsights/*/read",
58275829
"Microsoft.OperationalInsights/workspaces/analytics/query/action",
5828-
"Microsoft.OperationalInsights/workspaces/read",
5830+
"Microsoft.OperationalInsights/workspaces/*/read",
5831+
"Microsoft.OperationalInsights/workspaces/LinkedServices/read",
58295832
"Microsoft.OperationalInsights/workspaces/savedSearches/read",
58305833
"Microsoft.OperationsManagement/solutions/read",
58315834
"Microsoft.OperationalInsights/workspaces/query/read",
@@ -5859,8 +5862,9 @@ Azure Sentinel Responder
58595862
> | **Actions** | |
58605863
> | Microsoft.SecurityInsights/*/read | |
58615864
> | Microsoft.SecurityInsights/cases/* | |
5865+
> | Microsoft.SecurityInsights/incidents/* | |
58625866
> | Microsoft.OperationalInsights/workspaces/analytics/query/action | Search using new engine. |
5863-
> | Microsoft.OperationalInsights/workspaces/read | Gets an existing workspace |
5867+
> | Microsoft.OperationalInsights/workspaces/*/read | View log analytics data |
58645868
> | Microsoft.OperationalInsights/workspaces/dataSources/read | Get datasources under a workspace. |
58655869
> | Microsoft.OperationalInsights/workspaces/savedSearches/read | Gets a saved search query |
58665870
> | Microsoft.OperationsManagement/solutions/read | Get exiting OMS solution |
@@ -5893,8 +5897,9 @@ Azure Sentinel Responder
58935897
"actions": [
58945898
"Microsoft.SecurityInsights/*/read",
58955899
"Microsoft.SecurityInsights/cases/*",
5900+
"Microsoft.SecurityInsights/incidents/*",
58965901
"Microsoft.OperationalInsights/workspaces/analytics/query/action",
5897-
"Microsoft.OperationalInsights/workspaces/read",
5902+
"Microsoft.OperationalInsights/workspaces/*/read",
58985903
"Microsoft.OperationalInsights/workspaces/dataSources/read",
58995904
"Microsoft.OperationalInsights/workspaces/savedSearches/read",
59005905
"Microsoft.OperationsManagement/solutions/read",
@@ -6651,6 +6656,7 @@ Can view backup services, but can't make changes
66516656
> | Microsoft.RecoveryServices/locations/operationStatus/read | Gets Operation Status for a given Operation |
66526657
> | Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read | List all backup Protection Intents |
66536658
> | Microsoft.RecoveryServices/Vaults/usages/read | Returns usage details for a Recovery Services Vault. |
6659+
> | Microsoft.RecoveryServices/locations/backupValidateFeatures/action | Validate Features |
66546660
> | **NotActions** | |
66556661
> | *none* | |
66566662
> | **DataActions** | |
@@ -6705,7 +6711,8 @@ Can view backup services, but can't make changes
67056711
"Microsoft.RecoveryServices/operations/read",
67066712
"Microsoft.RecoveryServices/locations/operationStatus/read",
67076713
"Microsoft.RecoveryServices/Vaults/backupProtectionIntents/read",
6708-
"Microsoft.RecoveryServices/Vaults/usages/read"
6714+
"Microsoft.RecoveryServices/Vaults/usages/read",
6715+
"Microsoft.RecoveryServices/locations/backupValidateFeatures/action"
67096716
],
67106717
"notActions": [],
67116718
"dataActions": [],

0 commit comments

Comments
 (0)